Lateral Movement Across Networks
Lateral movement is how an attacker spreads from their first foothold toward real targets — and on the network, it is done with the network’s own protocols and trust. This article focuses on the network mechanics: the specific techniques that carry an intruder from host to host, and the traffic patterns that give them away.
How do attackers move across the network?#
They blend in by using legitimate administrative tools and reused credentials:
| Technique | Mechanism |
|---|---|
| Remote services | RDP, SSH, SMB, WinRM used as admins do |
| Pass-the-hash / pass-the-ticket | Reuse auth material without the password |
| Internal exploitation | Pivot through unpatched, trusting hosts |
| Credential reuse | Same password works on many systems |
Each hop typically pairs with privilege escalation: reach a new host, gain more rights, repeat. Because these are the same tools administrators use, the traffic looks legitimate unless you are watching for the right patterns.
How do you make movement visible — and hard?#
Two jobs: shrink the paths, and watch the ones that remain.
- Shrink: segmentation and microsegmentation cut which hosts can reach each other; least privilege limits what stolen credentials unlock; MFA on internal access defeats reused passwords.
- Watch: monitor east-west (internal) traffic for one account hitting many hosts, admin protocols at odd hours, and connections between machines that never normally talk.
Network lateral movement is the connective tissue of an intrusion. More at the Network Security hub.
Frequently asked questions#
How do attackers move laterally across a network?
They reuse the network’s own tools and trust: stolen credentials on remote services (RDP, SSH, SMB, WinRM), pass-the-hash and pass-the-ticket to authenticate without passwords, and exploitation of internal services that trust each other. The goal is to hop from the initial foothold toward high-value systems, ideally without triggering alarms.
How do you detect and limit lateral movement?
Limit it with network segmentation and least privilege so fewer paths exist, and MFA on internal access so stolen passwords do not work. Detect it by monitoring east-west traffic for unusual internal connections, a single account authenticating across many hosts, and administrative protocols used at odd times or between machines that never normally communicate.